Privacy · Current processing

Privacy Notice

Last updated: 9 September 2026. This notice describes the personal data used by the current information-only pilottrades.club website, its private owner portal and the hello@pilottrades.club support channel. It does not describe a customer product, checkout or payment service, because none is active.

1. Controller and contact

The controller is the website operator using the public brand Pilot Trades. Privacy requests may be sent to hello@pilottrades.club. The operator’s final legal name, legal representative and postal business address are not yet established; they will be established and added here before any commercial launch or deliberate commercial targeting of consumers in the EU/EEA. This present contact description is not a claim of commercial readiness.

2. Website delivery and security data

Cloudflare provides DNS, content delivery, hosting, serverless functions, D1 database storage, security and email routing. In providing those services, Cloudflare may process request data such as IP address, date and time, requested URL, browser or device information, network and security signals, and diagnostic logs. Pilot Trades uses this processing to deliver and secure the website, prevent abuse and diagnose faults. Where the EU GDPR applies, the intended legal basis is the controller’s legitimate interests in operating a secure, reliable information service.

3. First-party aggregate analytics

For a non-bot request to the homepage, server code reads the Cloudflare-supplied IP address and browser user-agent. It combines them with a secret and creates a pseudonymous HMAC-SHA-256 device hash. The analytics D1 database stores that hash with first-seen and last-seen fields, a daily copy of the hash, and daily page-view and estimated unique-device totals. The raw IP address and browser user-agent are not written to that analytics database, but Cloudflare may process them in infrastructure logs. The count is a device estimate, not an exact count of people. The purpose is limited audience measurement and service planning; where the EU GDPR applies, the intended legal basis is legitimate interests, balanced by pseudonymisation, aggregate reporting and the absence of analytics cookies.

4. Contact and support email

If you email hello@pilottrades.club, Pilot Trades processes your sender and recipient addresses, message ID, subject, message text, receipt time, raw message size, delivery and read status, and any reply text and delivery metadata. These data are used to receive, forward, store, review and answer the message, send an automatic receipt where appropriate, prevent duplicate replies, keep necessary correspondence and protect the support channel. Do not send passwords, API keys, broker credentials, financial account data or other sensitive information. Where the EU GDPR applies, processing is based on steps requested by you before a possible future contract, legitimate interests in correspondence and support security, and legal obligations where applicable.

5. Owner portal, cookies and local storage

The private owner portal is an internal analytics and support tool, not a customer account or trading interface. A successful owner login sets one strictly necessary pt_admin session cookie. It is Secure, HttpOnly and SameSite=Strict, and expires after eight hours; logout clears it. Login-abuse prevention creates a separate pseudonymous HMAC of the login IP address and stores attempts, timestamps and temporary blocking status. Successful login deletes that rate-limit record. No analytics, advertising or marketing cookies are used. The current public pages do not use browser local storage or third-party tracking pixels, and the Content Security Policy limits browser connections and resources to this site.

6. Service providers, recipients and transfers

Personal data may be available to authorized Pilot Trades personnel and to service providers needed for the purposes above: Cloudflare for website delivery, Workers, D1 storage, security and email routing; and Google (Gmail) for the forwarded support mailbox and outgoing manual support replies. Support messages are both stored in D1 and forwarded to the configured Gmail mailbox. Infrastructure and email processing may involve Switzerland, the EU/EEA, the United States and other countries in which those providers operate. Transfers must rely on an applicable adequacy decision or appropriate contractual and supplementary safeguards. No payment processor, customer-account provider or advertising network receives website data in the current scope.

7. Public market data

The browser requests the same-site chart endpoint. The server then obtains public BTC-USD candle data from Coinbase Exchange with a generic PilotTrades server identifier. The code does not intentionally send the visitor’s IP address, cookie or user-agent to Coinbase. Chart responses are cached briefly by Cloudflare.

8. Retention

The current code has no automated deletion schedule for analytics hashes, daily metrics, login-rate-limit rows, support messages or stored replies. They therefore remain in D1 until manually deleted, except a successful owner login deletes that network’s rate-limit record and the owner cookie expires after eight hours. Forwarded messages and sent replies remain in Gmail until deleted there under mailbox controls. Pilot Trades must review and delete personal data when no longer needed for the purposes above, subject to legal preservation duties, and will action valid deletion requests where applicable. A documented operational review and deletion cadence is required before commercial launch.

9. Your rights

Subject to applicable law and exceptions, you may request information about and access to your personal data, correction of inaccurate data, deletion, restriction of processing, objection to processing based on legitimate interests, and—where applicable—data portability. You may also withdraw consent for processing based on consent, without affecting earlier lawful processing. Because an analytics hash cannot ordinarily be linked back to a named person without the original request identifiers, Pilot Trades may need information reasonably necessary to verify identity and locate relevant data.

10. Complaints

Please contact hello@pilottrades.club first if you have a privacy concern. You may also contact the Swiss Federal Data Protection and Information Commissioner (FDPIC). If the EU GDPR applies to your processing, you may lodge a complaint with a supervisory authority, particularly in the EU/EEA country where you live, work or consider an infringement occurred.

11. Changes

This notice will be updated if the website’s processing changes. Customer accounts, payments, product telemetry or marketing communications must not be activated until their actual data flows, providers, legal bases, retention rules and user choices are documented here and the commercial legal hold is cleared.

Printed from pilottrades.club/privacy.html